A project manager wants to skip the security risk assessment for a new customer portal so the project can meet its launch date. What is the BEST way to prevent this situation in future projects?
Select an answer to reveal the explanation.
Short Explanation
If the safety inspection is a surprise at the end, it'll always feel like it's in the way. You build it into the project plan from day one at fixed checkpoints, and it stops being optional. The trap is postponing it until after launch, when changes cost the most.
Full Explanation
Security risk assessment is least disruptive and most effective when it is built into the project life cycle as a required activity at defined stages, such as initiation, design and pre-implementation, with gates that a project cannot pass without the assessment completed or a formal exception approved by an appropriate authority. Planning and resourcing it from the outset removes the conflict with launch dates, because the work is scheduled rather than discovered late. Performing the assessment after go-live means the portal operates with unknown risk and any required changes become more expensive and disruptive. Allowing project managers to waive the assessment when schedules are tight makes it optional in exactly the situations where pressure leads to shortcuts, and it lets a project role accept risk it does not own. Having security take over projects under deadline pressure confuses roles, overloads the security function and does not fix the governance gap. Exam caveat: where a waiver is truly necessary, it should be a formal risk acceptance by the business owner with conditions, not a project manager's decision. Operational check: confirm the project methodology lists the risk assessment as a mandatory gate deliverable and that project dashboards report gate compliance to the portfolio or steering committee.